Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,424
11,812
5,870
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with identified C2 infrastructure for NetSupport Manager malware, specifically domains themed around 'GTA6'. These indicators are used by attackers for command and control communication.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects TLS connections where the certificate subject is 'azure.uzrailwaystax.com' and the issuer is 'TLC DV TLS CA', indicating potential impersonation of the Uzbekistan railway authority infrastructure, likely associated with SilkParasite activity.
Detects HTTP GET requests to a specific URL path containing an image file, which is associated with the delivery of the LausivLoader malware. The rule monitors for external connections to the domain 'yapw.life' requesting a PNG file, a technique often used for steganographic payload delivery.
Detects network traffic associated with SilkParasite SpiceRAT malware, including direct IP connections, DNS queries for known malicious domains, and corresponding TLS SNI or HTTP Host header metadata indicating command-and-control (C2) activity.
Detects high-frequency TCP SYN packet bursts targeting port 37777 (commonly used by Dahua surveillance devices). The detection triggers when more than 50 SYN packets from a single source are observed within a 10-second window, suggesting automated reconnaissance or vulnerability scanning activity.
This rule detects suspicious UDP traffic directed at port 8800 targeting the Dahua P2P cloud relay interface. It specifically monitors for enumeration attempts against device serial numbers, which may be a precursor to unauthorized access or reconnaissance against vulnerable Dahua devices.
Detects outbound RDP-over-TLS traffic directed toward known SilkParasite C2 IP addresses on specific high-numbered ports, or generic RDP-over-TLS patterns on those same non-standard ports, which suggests tunneling or unauthorized remote access.
Detection rules identifying suspicious communication patterns associated with Dahua P2P Cloud Relay devices, including WSSE authentication attempts and device probing to known cloud relay endpoints. These patterns are consistent with reconnaissance and exploitation activity against IoT devices within the context of Operation CameraSwarm.
Detects HTTP responses containing content that clones the RTX Corporation homepage, often associated with SilkParasite C2 infrastructure. The rule flags matches based on embedded text in the HTTP body combined with specific nginx server header fingerprints.
Detects network activity related to the exploitation of Dahua P2P relay services via easy4ipcloud.com. The rule monitors for unauthorized device probing, serial number enumeration, and illicit relay authentication attempts (e.g., using DHP2P protocols and X-WSSE authentication), which are indicative of attackers attempting to abuse IoT device remote access functionality (CVE-2025-31702).
Detects network activity related to 'ClickFix' social engineering campaigns. The rules monitor for DNS queries, TLS SNI requests, and HTTP requests to the malicious domain 'cdnsuicaches.com' used for hosting malicious scripts, as well as the identification of the 'cookie-captcha-complete' string in HTTP traffic, which is a known indicator of a ClickFix social engineering overlay.
Detects high-frequency TCP SYN scanning activity targeting port 37777, commonly associated with the discovery of vulnerable Dahua DVR and NVR devices.
Detects network activity related to Dahua P2P relay services (easy4ipcloud.com) on port 8800. The rules monitor for device lookup queries (/online/p2psrv/), probe requests (/probe/device/), and the presence of WSSE authentication headers, which may indicate interaction with or exploitation attempts by tools targeting P2P-enabled surveillance hardware.
Detects outbound HTTP POST requests to the Telegram Bot API (/sendPhoto) that contain sensitive system information, including host credentials (port, login, password) and Shodan host data. This behavior is indicative of an information-stealing malware attempting to exfiltrate captured credentials via a Telegram bot.
Detects network communication with infrastructure associated with the Transparent Tribe threat group (APT36), including C2 traffic to a known malicious IP and DNS resolution for the sharema128.net domain, which are indicative of CrimsonRAT or Doxc malware activity.
Detects periodic beaconing and C2 communication patterns associated with the RapidRust Golang RAT, attributed to the APT36 (Transparent Tribe) threat group. The rule monitors for specific DNS queries to typosquatted domains, TLS SNI mismatches, and specific HTTP API polling activities commonly used by this malware for C2 tasking.
Page 50 of 110